Staff Security Engineer, Product Security

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Staff Security Engineer, Product Security based in the United States.

The Staff Security Engineer, Product Security will shape security architecture and engineering practices across a broad portfolio of products, services, and global infrastructure. This senior technical role combines hands-on security engineering with organization-wide architectural influence, ensuring that secure-by-default principles are embedded throughout product development. You will establish scalable security patterns, lead reviews of high-risk features, and guide engineering teams through complex design and threat-modeling decisions. Beyond individual security assessments, you will build programs, tools, and services that extend security expertise across hundreds of engineers. Working closely with platform, infrastructure, and product engineering teams, you will address systemic vulnerabilities and strengthen security throughout the software development lifecycle. You will also mentor engineers, lead multi-team initiatives, and serve as a trusted technical authority on product security.

• Define security architecture and strategy: Establish security architecture for products and services, creating scalable patterns and reference implementations that make secure-by-default development the easiest path for engineering teams.

• Lead security engineering reviews: Drive security reviews for the highest-risk product features and establish technical quality standards that guide reviews across the wider engineering organization.

• Lead threat modeling and attack surface analysis: Assess product domains and broader attack surfaces, identifying architectural risks beyond individual features and helping teams address them early in the design process.

• Guide complex engineering decisions: Partner with engineering leadership to evaluate and resolve significant security and architectural tradeoffs.

• Establish vulnerability management standards: Set expectations for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports, personally handling the most challenging or highest-severity cases when needed.

• Drive systemic remediation: Identify recurring vulnerability patterns and lead initiatives to address underlying security weaknesses rather than isolated findings.

• Build and own security services and tooling: Develop and maintain security services and tools consumed by product teams across global infrastructure, applying hands-on software engineering expertise.

• Scale developer security enablement: Build and expand the security champions program and product security training, extending security knowledge and sound technical judgment across engineering teams.

• Provide technical leadership and mentorship: Mentor security engineers and help develop them into senior technical contributors while serving as an authoritative product security voice across engineering leadership.

• Lead cross-team technical initiatives: Establish reusable approaches and practices that improve security consistency across multiple teams, products, and services.

Requirements

• Typically 8+ years of experience in product security, application security, or a related field, including substantial hands-on experience building security tools and services rather than focusing exclusively on reviews. Demonstrated capabilities and work are valued more than an exact number of years.

• Proven track record designing security architecture that scales across multiple teams, products, and services, rather than securing only an individual application.

• Strong understanding of web application security principles and practical experience using application security testing tools such as Burp Suite, OWASP ZAP, or similar solutions.

• Software development experience building security tools and services in at least one modern programming language, such as Go, Python, Java/Kotlin, TypeScript, or Ruby.

• Demonstrated ability to lead complex technical initiatives involving multiple engineering teams and drive adoption of shared security standards.

• Experience mentoring engineers and supporting their progression into senior technical roles.

• Strong architectural judgment and threat-modeling capabilities, with the ability to identify security risks and work collaboratively with engineering teams on practical solutions.

• Excellent communication and collaboration skills, including the ability to influence technical decisions across teams and explain security concepts to varied stakeholders.

Nice to Have

• Experience establishing, managing, or scaling a security champions program.

• Knowledge of identity management and identity federation technologies, including SAML, OAuth, and SCIM.

• Experience with IaaS cloud infrastructure, Kubernetes, container technologies, and service-oriented architectures.

• Hands-on experience with bug bounty platforms and Static Application Security Testing (SAST) tools such as Cycode, Semgrep, Snyk, or similar.

• Experience conducting code audits of internal or open-source libraries before they are released into production.

Benefits

• Competitive, location-based salary ranges:

  • California: $148,210–$270,703 USD.

  • Washington: $196,875–$270,703 USD.

  • Colorado: $148,210–$185,263 USD.

  • New York City: $196,875–$270,703 USD.

  • Illinois: $148,210–$185,263 USD.

• Bonus and equity opportunities as part of the total rewards package.

• Comprehensive medical and dental benefits.

• Flexible time off.

• Remote work opportunity within the United States.

• Access to modern hardware and software, including advanced AI models from the first day.

• Collaboration with globally distributed teams through Slack, video calls, and asynchronous documentation.

• An agile working environment where teams have flexibility to determine the practices that best support their work.

• Opportunity to shape security architecture and standards across hundreds of engineers.

• Close collaboration with platform, security, and infrastructure teams, with security treated as an engineering discipline supported by strong technical quality standards.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1